Source Code for the Built-in ASP.NET 2.0 Providers Now Available for Download

Today we released the source code for the built-in ASP.NET 2.0 Membership, Role Management, Site Navigation, Session State, Profile, Web Events, and Web Part Personalization providers (basically all of the built-in providers that ship in the .NET 2.0 Framework Redist). You can download them here, and learn more about the ASP.NET 2.0 Provider Model from this site here.

The source code is released under a permissive license that allows both commercial and non-commercial re-use of the source code, and should be very useful both for people wanting to build their own custom providers (you can take our source and just tweak it if you want), or to better understand/debug our existing ones.

The provider source code comes with a buildable VS 2005 Project all setup.

Jeff Prosise also wrote 130+ pages of awesome whitepapers that walkthrough the code, database schema, and how they work. You can read them here:

The beauty of the ASP.NET 2.0 Provider model is that it delivers rich extensibility and flexibility to the built-in productivity features you get with ASP.NET 2.0. Out of the box with ASP.NET 2.0 you get a secure user management and role credential store (no need to write any database code -- just call Membership.CreateUser() or use the <asp:login> controls and you are good to go). Because you can plug-in custom provider implementations, though, you also have the flexibility to customize the implementations in the future if you want (or adapt them to go against existing databases or stores that you already have with other applications). Code written to the Membership APIs or <asp:login> controls will work regardless of what provider you have configured in your web.config file.

To learn more the new ASP.NET 2.0 Security Features, please check out this post I did a month ago. It provides links to tons of content (including a nice 12 minute video you can watch to learn how easy it is to add Membership and Roles to a site from scratch). It also links off to a number of other providers (including Access and MySql ones) that people have already written.

The code for the ActiveDirectoryMembershipProvider would be awesome. Thanks for making this available for download...what a great resource and learning tool. Speaking of learning tools, I'd certainly benefit from some additional Starter Kits, I learned a ton from the original 1.1 kits. The 2.0 starter kits don't seem to be as good.

You mentioned in this blog that we can tweak the source code of built-in providers. I have not have chance to look at the source code yet. I am wondering if we can change the signature of a function. For instance, for our case, we really want to change the createUser() to take more parameters if we can. I like to use the createuserwizard but I found I need to resort the event of CreatingUser to get my implementation to work. this happens in a project I just finshed and I need to face similar situation in my next project.

You need to have the same signature for the Membership contract. But what you can do is add new methods with overloaded parameters. There is then a way to get access to them via the Membership API within an application.

All I can say is WOW! Very nice. I'll mark this off my wishlist. I'm glad that the .NET team really is listening to their users. I know this would have helped me out a ton, and I'm sure will help many many programmers be able to quick start their own providers, and understand the default ones much better. Hats off to you guys for doing this for us!

You can ceretainly call a V1.1 assembly from a V2.0 one. I'm not 100% sure if you can do the reverse though -- it probably depends on the signature of the assembly (and whether you are exposing or using any new V2.0 features or APIs).

A bug in the installer though: the .msi won't install as a non-admin. Ignores the entered path and wants to write to Program Files (and a different path to the default too!). A plain old .zip would have been sufficient.

Why are the providers based on abstract classes, not interfaces, that seal some methods which cannot be extended? This creates major issues when creating proxy classes for some of these objects. The proxy will not be able to extend the non-virtual methods.

The providers were abstract classes by default for versioning reasons (to help us extend in the future). If you want to send me email, I can send you a sample set of providers that implement Web Service remoting fo rthe providers for multi-tier deployment.

We have been experimenting a lot with providers and I gotta say it's a cool design pattern.

Adam and Scott:

We did, just as a proof of concept, some samples of how to use the providers through WS, Remoting and MockClasses using some kind of ServiceAgent to decouple the Proxy from the provider's contract. It's something simple, but it worked, if you need the code, just e-mail me (junk@intecmex.com).

Scott, could you post or e-mail me your sample set to compare it with what we did. Thanks.

Scott, I've used the tutorials for the &quot;Provider&quot; tools extensively but some things are not covered or they are so loosely arranged it's hard to make sense of it for someone very new to web development (less than 6 months).

Has someone (that you know of) put together a fully functioning example that makes use of the provider/membership/profile toolkit so that it demonstrates user managment/creation and then individual user updating like viewing their profile etc...

When I google all results go to one other blog and then to the ASP Tutorials pages. Do you know of such a resource to assist someone like me?

the download that you have posted near the top of your blog post is for the Table Provider SQL Samples, not the &quot;basically all of the built-in providers that ship in the .NET 2.0 Framework Redist&quot; as you indicate. That is, at least at the time I downloaded it.

These are great and I am very happy that Microsoft has done this. This is the greatest way to build a strong community of developers such as the PHP,Python,Perl, etc communities.

As much as I like these I would also love to see some composite controls source code. I am struggling right now with composite controls. There are not near as many tutorials about them as there are about providers and I think this would be a great way to initiate those kinds of articles and get some nifty built controls from the community!

There is a &quot;Provider&quot; property on the APIs like Membership, Roles and others. This gives you access to the provider instance. Its default type is the provider base class - but you can just cast this however you want to get back to your specific subclass type.

Forgive me if this is a stupid question but I'm fairly new to .net. Is there a reason why the provider source wasn't released in VB? Is C# the standard .net language now? I'm asking because most of the samples I find these days are C#.

Generally we try and ship all of our samples in both C# and VB. The reason the source code providers are C# only is because this is less of a sample, and more the real code that we ship in the product (and ASP.NET is written in C#).

I'll send you a mail about wednesday next week, because I'm learning for my exam next tuesday. I found a proprietary solution only working in overriding the OnError method of the login control. But I guess/hope there is a way not to do this.

Your site is fantastic, &nbsp;I have been searching for a fully functionally provider to usr with an Access DB. I see the C# one on microsofts site, but all my code is in VB and I really would like one in VB. &nbsp;I have found a few that just provide authentication and create user, &nbsp;but none that have methods for all the membership controls, Like change password, get users online, change password, lookup user by email. Is there anything complete for use with access DB as apposed to SQLMemeberShipProvider. Jeff barclayvision@hotmail.com

Has anybody actually installed the source code? &nbsp; &nbsp;Whenever I run the installer, nothing gets installed, no files are where the installer was told to put them. &nbsp;Why is it in a .msi? &nbsp;Can it just be zipped?

Hi; First off, thanks for releasing this. I have a couple of questions: 1) What is the recomended way to use this if we are going to change it? I assume changing the class name and setting it as the roleManager in Web.config. If it is in a DLL in the Bin directory for my app, is that sufficient or should I do something else? 2) Is there a sql script that will create the database? I need it for the membership &amp; role provider. If not, is there a way to get the database created in SqlServer so we can pull everything from there? thanks - dave

To your question about the SQL schema -- the provider source shipped above use the same schema that the aspnet_regsql.exe utility generates. So you can use this utility to generate your schema for you.

To re-use the classes, I'd recommend building into a assembly .dll and just adding it to your \bin directory (or referenced from your project). You'd then want to update your provider declarations within the web.config file to reference it.

Thank you for the pointers to the Oracle &amp; MySql providers. I was thinking we would port the SqlServer one (hence the request for the sql script, to pull that in to ErWin). But as these others exist, I think we may just use each as is.

i've read the article about configuring ASP.NET 2.0 to use SQL server 2000, but i've come across a problem. Using the aspnet_regsql.exe tool failed and I get an error saying that sp_addrole needs @strUserPassword, which is not supplied. I've discovered that the problem is caused during the creation of Roles in SQL 2000. Can u provide me a solution for this? Thanks in Advance, Will

Hi Scott, Thanks for the quick reply. Let me be more specific. With the installation of VS 2005 a database ASPNETDB has been created that DO contain the necessary roles (aspnet_Roles etc) and tables. I use windows authentication to access the SQL server and I have full access as the administrator to the SQL database. I can copy the tables and views to my Custom DB but if i try to copy all the objects including the relations etc I get the error I mentioned before. The aspnet_regsql was only able to create the aspnet_Users, aspnet_Memberships and 2 other tables. I was able to locate the problem with Roles creation because I use the DTS to copy one thing at a time (first tables, views). The exact error msg is: Exception: An error occurred during the execution of the SQL file 'InstallMembership.sql'. The SQL error number is 201 and the SqlException message is: Procedure 'sp_addrole' expects parameter '@strUserPassword', which was not supplied. Procedure 'sp_addrole' expects parameter '@strUserPassword', which was not supplied. Procedure 'sp_addrole' expects parameter '@strUserPassword', which was not supplied. This errormsg appears if I try to create the Roles manually. Thanks in advance, Will

I'm unable to see anything after installing the msi above. Have tried on a couple of pcs, it says it's successfully installed, but nothing in the folder, have tried dropping to different folders, but no joy, very strange!

It would be really useful to have the source as vb. I am working with Web Express, and all of my classes are written in vb, therefore I cannot integrate the c# samples. Web Express says it can't compile both types.

Is there anyway to use membership provider in a real application using a production SQL database? All I can get working is the automatic SQL Express in the app-data folder, not a real database. And, the SQL Express breaks the first time it’s viewed with SQL express manager and never works again. Once done, I can find no configuration options, no way to fix problems, no way to move it to a production environment.

After wasting hours trying to make this work, I need someone say it can even be don ein a production environment before spending more time on this.

I need to write an application, which can write/send/receive SMS and edit the phonebook from a device running the Windows .Net platform.
The device will be connected to any type of GSM using the serial port.

Thanks for releasing the source. Unfortunately the code that would help me is missing! I need to build a new RoleProvider that will query an extended Active Directory schema. This will be very similar to the
ActiveDirectoryMembershipProvider but will not actually implement the Membership provider interface, I will develop a new RoleProvider class. Please can you release the source for the ActiveDirectoryMembershipProvider?

I am about to start working on a new wbsite development using ASP.NET 2.0. As every other developer, I need to extend the User table to store additional attributes (like PostCode, Age etc.) of the user. I can also keep these additional attributes in the Profile table. I am not sure what is the best place for these attributes (add them to User table or the Profile table). Using Profile table seems less work to me. Please advise.

Storing properties about users in the Profile object is definitely the easiest way to accomplish this.

You might also want to look at these simple providers that you can plug into your application if you want total control over the database schema used: http://weblogs.asp.net/scottgu/archive/2006/10/13/Tip_2F00_Trick_3A00_-Source_2F00_Documentation-for-Simple-ASP.NET-2.0-SQL-Providers-Published.aspx

This source code is a life saver! I tried merging the schema with a new db setup (i linked the users table to my custom application db) and the default implementation of the Sql Providers uses "dbo.aspnet_SP" in its implementation of stored procedure calls. In a shared hosting environment you almost never have dbo access and instead are placed in an account named after your database. Using the source code you can quickly remove the "dbo." bits to resolve this issue. Thanks again for releasing the source!

The aspnet_Membership_FindUsersByName stored procedure and the aspnet_Membership_GetAllUsers SP extract the entire User/Membership tables (or potentially large portions of them) into a temporary table with an identity column.

While this method works great with <100 members, I was hoping to scale it to perhaps 3,000,000 members. I tried increasing the timeout and it performs awful, if at all.

Has anyone taken these and ported them to use in Smart Client or WinForm applications? I need to do this as I want to use this for our own apps, but if nobody has done it I'll update the code and put it back into the community. Let me know.

If you want to email me directly, I can help answer some questions you might have about the ActiveDirectoryMembershipProvider. Are there specific scenarios that you are running into?

Also - there is a role provider for activedirectory. Unfortunately I don't have VS on me right now - but if you search in the System.Web.Security namespace you should see a WindowsRoleProvider or something like that.

Is there a simple way to use an existing SQL 2005 Database schema instead of having to run the aspnet_regsql.exe tool to create a different Schema? I've not seen any articles on this. I've already got a SQL Server 2005 database with thousands of User Login information in a table and need the ASP.NET membership provider to use that table/database instead of a new schema added to my already existing database structure. Are there any good tutorials on this subject?

I'd recommend checking out this set of Simple Membership Providers: http://weblogs.asp.net/scottgu/archive/2006/10/13/Tip_2F00_Trick_3A00_-Source_2F00_Documentation-for-Simple-ASP.NET-2.0-SQL-Providers-Published.aspx

It provides a good example of how you can build your own Membership provider that goes against your existing User tables.

Your Blog has been the source of countless "That's It!" moments for me already - thanks.
My custom role provider will handle multiple databases on a per session basis (ie the user profile tells me where to connect). All the child DBs will also use the standard ASPNETDB schema within them, so all I really want to do is sneak in a new connection string into SqlRoleProvider on a per-session basis.

However, it looks to me that I'll have to re-write the bulk of the code since I don't have access to a sqlConnectionString property.

1. If there's an easier way to insert a new connection string into your Sql Providers on a per-session basis via user.profile, I'd be happy...

2. Since I want to reuse the bulk of your SqlRoleProvider code, I've run into an issue where I can't access your providers SqlConnectionHelper class (Among others):
Error: System.Web.DataAccess.SqlConnectionHelper is inaccessible due to its protection level.

Will I have to write a my own Data Access Layer for my provider even though it will do the same thing as yours (at least for security)?

I believe there is a way to dynamically switch the connection string - although I can't remember right now exactly how to-do it. Can you send me email (scottgu@microsoft.com) repeating the question and I can loop you in with someone who can help?

I have two domains, we are currently in the progress of migating from "OldDomain" to new "NewDomain" users exist with the same name on both domains. Do you think it would be possible to extend the existing windows provider so that the logged on identity to authenticate users in a domain agnostic manner?